Straight answers, no fine print.

A protocol on Robinhood Chain that lets you borrow USDG against tokenized stocks and real-world assets for a single fixed fee, without selling the asset and without disclosing the rest of your portfolio.

No. Collateral is pledged into the protocol's escrow for the life of the position and returned in full when you close it. It is never sold, lent out or rehypothecated; the only way it leaves escrow without your instruction is a liquidation after the position falls to the maintenance threshold.

Correct. The contracts have no interest-rate logic at all. The only cost of a credit line is the origination fee charged at the moment you draw, and the amount you repay is exactly the amount you drew.

USDG, the Global Dollar stablecoin, from the stability pool. The pool's asset is set at deployment; on chains where USDG is not available another USD stablecoin can be used because the contracts read the asset's decimals.

Two sides. Borrowers holding tokenized positions who want liquidity without an exit. Pool participants who want a USD-denominated return that comes from fees, liquidation outcomes and partner revenue rather than from an interest curve.

Get a collateral passport from the verification service, approve the collateral token, then call open(asset, collateralAmount, drawAmount, passport, signature). You can open with a zero draw and draw later. The terminal shows exactly what a given position will cost and yield before you commit.

The smaller of two limits: the class maximum LTV applied to the accepted value of your collateral (e.g. 60 % of $10,000 = 6,000 USDG), and the capacity written in your passport. Draws under one passport are cumulative; repaying frees capacity.

Yes. Anyone can add collateral to any position (useful for topping up from another wallet). Only the owner can withdraw, and only as long as the position stays at or below the maximum LTV with a fresh price.

Yes. Repayment is permissionless. Whoever calls repay pays. A repayment may not leave a remainder below the dust floor (100 USDG by default); repay in full instead.

Nothing to your existing debt. You cannot make new draws until you present a fresh passport; maintenance and liquidation rules continue to apply as normal. Presenting a newer passport re-attributes your existing debt to it.

Debt, if any, must be at least minDebt (100 USDG by default). There is no minimum collateral beyond what the LTV requires.

Yes. Each position is a separate id with its own asset, collateral and debt. One passport may back several positions in the same asset as long as their combined debt stays within its capacity.

fee = amount × originationFeeBps / 10 000, deducted from the draw. At 1.5 %, a 10,000 USDG draw costs 150 and you receive 9,850. The fee is set per collateral class and capped on-chain at 10 %.

A share (poolFeeShareBps, 70 % in the examples) stays in the stability pool as income for depositors; the rest goes to the protocol treasury.

Whenever the line stays open longer than fee ÷ APR. A 1.5 % fee equals about 2.3 months of an 8 % APR facility; beyond that the fixed fee wins. The terminal's cost table shows the break-even for any inputs.

It funds a programmatic buyback of BEZALT ($BEZALT), the protocol token. BuybackRouter spends the accumulated USDG on an allow-listed BEZALT/USDG venue, at most once per epoch, capped at a small percentage of pool depth and only within a tight band of the venue's 30-minute TWAP. Purchased tokens are burned or sent to the staking reserve in the same transaction. See the fee routing spec.

No. The pool's share (poolFeeShareBps) is retained in the pool before the treasury receives anything, and the router has no path to pool principal or pool income. Depositor returns are the same whether or not a buyback executes.

Not yet. Fee splitting is part of the v1 contracts; the BEZALT token and BuybackRouter are specified for v1.1 and will be audited together before the treasury share is routed on-chain. Until then the treasury share accumulates in the treasury multisig.

No protocol fees. You pay only network gas (ETH on Robinhood Chain).

An EIP-712 attestation signed by the verification service saying that your position in a given asset passed ownership, valuation, eligibility and liability checks and may carry up to a stated debt until a stated expiry. It carries a commitment to the checks (a hash), never the inputs.

Your address, the collateral asset, the amount you pledged, your debt, and the passport's capacity bound and expiry. It never learns which other assets you hold, in what quantity, in which wallets, or what your liabilities elsewhere are.

During a check: signed data from issuers, custodians and oracles about the position being verified. Inputs are discarded once the passport is signed; the on-chain record keeps only the hash of the procedure.

Yes, individually by the attester or the admin, and en masse by a cut-off timestamp (setMinIssuedAt) after an attester key rotation. Revocation stops new draws; existing debt is unaffected.

Yes. A passport is self-contained: any venue can recover the signer, check role membership on the registry, check the window, and check the revocation flag, all without contacting the issuer or learning what was checked.

Not in the cryptographic sense. Privacy comes from minimal disclosure and a trusted attester, enforced by signatures and on-chain bounds. A ZK-backed attester is a natural future upgrade because the passport format does not depend on how the checks were performed.

When your LTV reaches the class maintenance threshold under a fresh price, e.g. 75 % when the maximum LTV is 60 %. A position opened at max LTV has a 20-percentage-point price buffer in that example class.

The stability pool absorbs your entire debt and receives collateral worth debt × (1 + bonus) at the oracle price. The keeper who triggered it receives a small share of that seized amount. Whatever collateral remains is returned to you immediately, and the position is closed.

No. Liquidation clears the whole debt in one step and returns the excess collateral. Add collateral or repay before the threshold to avoid it.

The pool takes all of it and realises the shortfall through its share value. You owe nothing further; the protocol does not pursue borrowers beyond their collateral.

Anyone. Calling liquidate on an eligible position pays the caller keeperFeeBps of the seized collateral (0.5 % in the examples). previewLiquidation(id) shows the outcome before sending the transaction.

Yes, by the guardian, independently of the protocol pause, for example during an oracle incident. Repayment and adding collateral remain available so borrowers can protect themselves while liquidations are halted.

ERC-4626 shares (ambUSDG) of a vault whose value is idle USDG plus loans outstanding plus the oracle value of seized collateral. Share value rises with fee income, liquidation gains and partner revenue; it falls when a liquidation is short of collateral.

Because nothing accrues with time. The pool earns when a draw happens (fee share), when a liquidation happens (collateral bonus), and when a partner pays revenue. A quiet week earns nothing; an active week does.

You can withdraw up to the pool's idle USDG. Principal that is lent out returns as borrowers repay, and seized collateral becomes withdrawable once it is sold. maxWithdraw(address) always tells you the current limit, and a reserve keeps part of the pool unlent so ordinary withdrawals clear.

Anyone can buy it from the pool at oracle value minus a small discount (2 % in the examples). Because the pool received it at a larger bonus, the round trip is typically positive for depositors.

Yes. It uses a six-decimal virtual-share offset. The test suite shows an attacker must lose more than a thousand times what it could extract from a victim.

Their positions (getPosition), live LTV (ltvBps), remaining capacity (maxAdditionalDraw) and a fee quote (quoteFee). All are view functions; the integration guide in the docs lists events to index.

Call PassportRegistry.verify(passport, signature), it reverts unless the passport is valid, unrevoked and in window, and returns its id. You can also reproduce the check off-chain with any EIP-712 library and the registry's domain separator.

Allow-listing of the CreditLine and StabilityPool addresses so escrow transfers succeed, a price source (a Chainlink feed, or your NAV signed for the attested oracle), and a policy for distributions paid while tokens sit in escrow.

No. They illustrate the categories of venue the protocol is designed to work with, issuers, wallets, lending markets, and do not indicate partnership or endorsement.

No. There are no proxies. Parameters can move within on-chain bounds through governance; logic can only change by deploying new contracts and pausing the old ones after the timelock delay.

A TimelockController with a 48-hour delay is the admin of every contract; a governor multisig proposes through it and holds the bounded risk-parameter role directly; a separate guardian holds the pause switches. The deployer's admin rights are renounced at deployment and verified.

It stops new exposure: opens, draws, collateral withdrawals, pool deposits and funding. It never stops repayment, adding collateral, closing a debt-free position, pool withdrawals or collateral sales. Liquidations have their own switch.

Not yet by a third party. It ships with 87 tests including fuzzing and nine system invariants, 100 % line coverage, a Slither pass with no high-severity findings, and a scripted end-to-end dry run. An external audit is a hard prerequisite before mainnet.

Borrowing, withdrawing and liquidating that asset all revert until a fresh price arrives. In the pool, stale seized collateral is valued at zero so deposits and withdrawals keep working; the risk admin sees the affected assets via unpricedSeizedAssets().

Fee-on-transfer tokens are rejected on deposit; rebasing tokens are unsupported. Standard ERC-20s with any decimals up to 30 are fine.

Robinhood Chain is an Arbitrum Orbit L2 settling to Ethereum. Mainnet chain id 4663, testnet chain id 46630, gas paid in ETH, Blockscout explorers. The deployment script refuses to run if the connected RPC reports a different chain id.

Yes, for gas on Robinhood Chain. Bridge through the Arbitrum bridge portal.

Published in the Contracts section of the docs once testnet and mainnet deployments exist; addresses are also committed to contracts/deployments/<chainId>.json in the repository.